What is the primary purpose of HMAC?

To provide message authentication using a shared secret key.

To encrypt data so that it cannot be read by unauthorized parties.

To compress data for storage efficiency.

To generate random numbers for cryptographic use.

Which of the following correctly distinguishes SHA-1 from SHA-2?

SHA-1 is a keyed hash, while SHA-2 is unkeyed.

SHA-1 uses a sponge construction, while SHA-2 uses a Merkle–Damgård construction.

SHA-1 is based on AES, while SHA-2 is based on the Keccak permutation.

SHA-1 produces a 160-bit digest, while SHA-2 includes variants with 224-, 256-, 384-, and 512-bit digests.

A developer is building a high-performance hashing module for a 64-bit embedded system that also needs to resist length-extension attacks. The module will be used for message authentication with a shared secret. Which combination of hash and construction is most appropriate?

Tiger with plain secret concatenation

SHA-256 with plain secret concatenation

A company's legacy application stores password hashes using MD5 with a per-user salt. A security audit flags this as a risk. The application must remain compatible with existing password hashes during a transition period. Which approach best addresses the audit finding while maintaining compatibility?

Use HMAC-MD5 with a site-wide key

On next successful login, rehash the password with a stronger algorithm

Replace MD5 with SHA-256 and rehash all passwords immediately

EC-CouncilCertified Encryption Specialist

Domain 2Objective 3

Hashing Algorithms (MD5, SHA, RIPEMD, Tiger, Whirlpool) and HMAC ECES Practice Questions (Page 5)

Part of the Symmetric Cryptography and Hashing domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

9concepts

Questions 21–25

21foundation · easy
What is the primary purpose of HMAC?
Select an answer first
22foundation · easy
Which of the following correctly distinguishes SHA-1 from SHA-2?
Select an answer first
23expert · hard
A developer is building a high-performance hashing module for a 64-bit embedded system that also needs to resist length-extension attacks. The module will be used for message authentication with a shared secret. Which combination of hash and construction is most appropriate?
Select an answer first
24application · medium
A company's legacy application stores password hashes using MD5 with a per-user salt. A security audit flags this as a risk. The application must remain compatible with existing password hashes during a transition period. Which approach best addresses the audit finding while maintaining compatibility?
Select an answer first
25application · medium
A compliance standard requires that all digital signatures use a hash function that is not part of the SHA-2 family. The system currently supports SHA-512 and RIPEMD-160. Which hash should be used for new signatures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.

Hashing Algorithms (MD5, SHA, RIPEMD, Tiger, Whirlpool) and HMAC ECES Practice Questions (Page 5)

Questions 21–25

What is the primary purpose of HMAC?

Which of the following correctly distinguishes SHA-1 from SHA-2?

A developer is building a high-performance hashing module for a 64-bit embedded system that also needs to resist length-extension attacks. The module will be used for message authentication with a shared secret. Which combination of hash and construction is most appropriate?

A compliance standard requires that all digital signatures use a hash function that is not part of the SHA-2 family. The system currently supports SHA-512 and RIPEMD-160. Which hash should be used for new signatures?

Keep studying — Symmetric Cryptography and Hashing